diff --git a/Changelog.md b/Changelog.md
--- a/Changelog.md
+++ b/Changelog.md
@@ -1,3 +1,8 @@
+# 1.2.3
+
+* Added a bit more documentation to `applyCORS`. Thanks to Alfredo Di Napoli for
+  discovering this tricky behaviour.
+
 # 1.2.2
 
 * Increased upper bound on case-insensitive. Thanks to Ricky Elrod (@CodeBlock).
diff --git a/snap-cors.cabal b/snap-cors.cabal
--- a/snap-cors.cabal
+++ b/snap-cors.cabal
@@ -1,5 +1,5 @@
 name:                snap-cors
-version:             1.2.2
+version:             1.2.3
 synopsis:            Add CORS headers to Snap applications
 description:
   Add CORS (cross-origin resource sharing) headers to Snap applications. This
diff --git a/src/Snap/CORS.hs b/src/Snap/CORS.hs
--- a/src/Snap/CORS.hs
+++ b/src/Snap/CORS.hs
@@ -111,6 +111,16 @@
 -- | Apply CORS headers to a specific request. This is useful if you only have
 -- a single action that needs CORS headers, and you don't want to pay for
 -- conditional checks on every request.
+--
+-- You should note that 'applyCORS' needs to be used before you add any
+-- 'Snap.method' combinators. For example, the following won't do what you want:
+--
+-- > method POST $ applyCORS defaultOptions $ myHandler
+--
+-- This fails to work as CORS requires an @OPTIONS@ request in the preflighting
+-- stage, but this would get filtered out. Instead, use
+--
+-- > applyCORS defaultOptions $ method POST $ myHandler
 applyCORS :: Snap.MonadSnap m => CORSOptions m -> m () -> m ()
 applyCORS options m =
   (join . fmap decodeOrigin <$> getHeader "Origin") >>= maybe m corsRequestFrom